Repository navigation
feat(agent,agent-installer): add macOS installer package - #2192
Open
Marc-André Moreau (mamoreau-devolutions) wants to merge 3 commits into
Open
Marc-André Moreau (mamoreau-devolutions) wants to merge 3 commits into
Marc-André Moreau (mamoreau-devolutions) wants to merge 3 commits into
Conversation
Devolutions Agent now ships for macOS as one installer package per architecture. The package installs the `com.devolutions.agent` launchd daemon, which runs as root, starts at boot, and restarts after a crash. Installing creates a default configuration when none exists, and upgrading keeps the existing one. `devolutions-agent-uninstall` removes the Agent, and `--purge` also removes its configuration and logs. On macOS, `devolutions-agent start` and `stop` act on the installed daemon. The macOS identity, tunnel, and PowerShell Universal features match Linux. The Package workflow signs the executable, signs the installer with a Developer ID Installer certificate, and notarizes it. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Reuse the existing Developer ID Application and Apple notarization secrets. Add separate Installer certificate secrets for the Agent package, and verify both architecture binaries and packages in production. Fail macOS signing errors and document the required environment secrets. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Marc-André Moreau (mamoreau-devolutions)
requested review from
a team
as code owners
November 9, 2026 21:53
Let maintainers know that an action is required on their side
|
Contributor
Author
|
Change summary
UNTESTED: Note Human-tuned, LLM-assisted content. |
Copilot started reviewing on behalf of
Marc-André Moreau (mamoreau-devolutions)
November 9, 2026 21:54
Reference the Developer ID Installer certificate and password under the names available to the package workflow. Update the signing documentation to match. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Marc-André Moreau (mamoreau-devolutions)
changed the title
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Critical issues permit root execution of user-controlled PowerShell when PSU is enabled and expose credentials through insecure permissions on existing configuration directories.
3 open issues
What changed in this PR
This PR adds macOS Agent installer packages to the build and release pipeline, with production signing and notarization verification for both architectures.
Changes:
- Add architecture-specific packages, launchd configuration, installation scripts, and lifecycle checks.
- Sign Agent binaries and packages, notarize packages, and verify production artifacts.
- Publish macOS packages and document installation and required signing secrets.
| File | Description |
|---|---|
package/AgentMacOS/Test-Package.sh |
Checks installation, service control, upgrade, and removal. |
package/AgentMacOS/scripts/preinstall |
Stops the existing service before payload replacement. |
package/AgentMacOS/scripts/postinstall |
Initializes configuration and loads the daemon. |
package/AgentMacOS/README.md |
Documents installation, operation, removal, and packaging. |
package/AgentMacOS/distribution.xml |
Defines architecture and OS requirements for the installer. |
package/AgentMacOS/devolutions-agent-uninstall |
Removes the service and optionally purges stored data. |
package/AgentMacOS/com.devolutions.agent.plist |
Defines the launchd daemon and its environment. |
devolutions-agent/src/cli.rs |
Uses the package’s launchd label for macOS service control. |
ci/tlk.ps1 |
Builds and optionally signs macOS Agent packages. |
.github/workflows/release.yml |
Includes both macOS packages in release outputs. |
.github/workflows/README.md |
Documents macOS signing and notarization secrets. |
.github/workflows/package.yml |
Signs, notarizes, and verifies macOS Agent artifacts. |
.github/workflows/ci.yml |
Builds macOS Agent packages and checks arm64 installation. |
Review effort: Balanced
| <key>EnvironmentVariables</key> | ||
| <dict> | ||
| <key>PATH</key> | ||
| <string>/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin</string> |
Comment on lines
+11
to
+14
| if [ ! -d "$DATA_DIR" ]; then | ||
| /bin/mkdir -p "$DATA_DIR" | ||
| /bin/chmod 700 "$DATA_DIR" | ||
| fi |
Comment on lines
+12
to
+15
| while /bin/launchctl print "system/$LABEL" >/dev/null 2>&1 && [ "$i" -lt 60 ]; do | ||
| /bin/sleep 1 | ||
| i=$((i + 1)) | ||
| done |
Marc-André Moreau (mamoreau-devolutions)
deployed
to
publish-prod
November 10, 2026 00:03 — with 
GitHub Actions
Active
GitHub Actions
Active
Marc-André Moreau (mamoreau-devolutions)
deployed
to
publish-prod
November 10, 2026 00:03 — with
GitHub Actions
Active
GitHub Actions
Active
Marc-André Moreau (mamoreau-devolutions)
deployed
to
publish-prod
November 10, 2026 00:03 — with
GitHub Actions
Active
GitHub Actions
Active
Marc-André Moreau (mamoreau-devolutions)
deployed
to
publish-prod
November 10, 2026 00:03 — with
GitHub Actions
Active
GitHub Actions
Active
Marc-André Moreau (mamoreau-devolutions)
deployed
to
publish-prod
November 10, 2026 00:03 — with
GitHub Actions
Active
GitHub Actions
Active
Marc-André Moreau (mamoreau-devolutions)
deployed
to
publish-prod
November 10, 2026 00:03 — with
GitHub Actions
Active
GitHub Actions
Active
Marc-André Moreau (mamoreau-devolutions)
deployed
to
publish-prod
November 10, 2026 00:03 — with
GitHub Actions
Active
GitHub Actions
Active
Marc-André Moreau (mamoreau-devolutions)
deployed
to
publish-prod
November 10, 2026 00:03 — with
GitHub Actions
Active
GitHub Actions
Active
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Enable Devolutions Agent on macOS with separate arm64 and x64 installer packages.
Install and start the Agent as a root launchd daemon, preserve configuration during upgrades, and provide an uninstaller with an optional purge.
Build, sign, notarize, and publish the packages through the release workflows using the configured Apple credentials.
Co-authored-by: Copilot App 223556219+Copilot@users.noreply.github.com